AIKIDO-2026-10743

TL;DR

The Fetch-based HTTP stack used in no-axios and minimal bundles treated redirect and body-size ceilings as optional even though higher layers pass them as SSRF and denial-of-service guards during federation and stellar.toml resolution. Federation helpers could initiate lookups against malformed domain shapes before those guards ran consistently across builds. SEP-10 challenge verification could accept signer lists when only server-side material matched instead of proving an intended client signer. WASM metadata parsing could stall or mis-advance offsets while skipping malformed custom sections.